XhangerCS2Lite[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
XhangerCS2Lite.exe
Size 1.1MB
Sample260809-aak2saeq9x
SHA256 58d63d63ba58859fbdcc888842856d054bdf551945c0d8d03dc9489d6df24c05
MD5 3ed2c582c7310b2926ab8ddcb1fadd2f
SHA1 20102cc731a607b572000cb9f9c093f0d6604790
SHA512 50be358072412edce6f414255d10f38bbb74a2d4001064344fae8f2c5d0efa347ff9460930816af81b1b460e9620f518cf5d4faa42baf22e10d5fb3771aa07d9
SSDEEP 24576:C4SCctUXaZ9EzOUoIyGfoJVNbjZO0R5P3rjD3gPH2EF1:CInXaZXHzGfmBOw3rjDZs
TLSH
T1DB35D003F3A2C33ACB17283186A6E762567FBC501B12918773A82959DFD31E04F9B6D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
XhangerCS2Lite.exe

File Explorer

XhangerCS2Lite.exe

.exe 1.1MB

XhangerCS2Lite.exe

IMPHASH a02d1a01e57c45f7af584da73e9fff85
SHA256 58d63d63ba58859fbdcc888842856d054bdf551945c0d8d03dc9489d6df24c05
MD5 3ed2c582c7310b2926ab8ddcb1fadd2f
SHA1 20102cc731a607b572000cb9f9c093f0d6604790
SHA512 50be358072412edce6f414255d10f38bbb74a2d4001064344fae8f2c5d0efa347ff9460930816af81b1b460e9620f518cf5d4faa42baf22e10d5fb3771aa07d9
SSDEEP 24576:C4SCctUXaZ9EzOUoIyGfoJVNbjZO0R5P3rjD3gPH2EF1:CInXaZXHzGfmBOw3rjDZs
TLSH
T1DB35D003F3A2C33ACB17283186A6E762567FBC501B12918773A82959DFD31E04F9B6D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

209739

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

kernel32

QueryPerformanceFrequency QueryPerformanceCounter GetModuleFileNameA lstrcatA Sleep GetFileAttributesA CloseHandle SetFileAttributesA CreateProcessA WriteConsoleW HeapSize CreateFileW SetStdHandle GlobalUnlock GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetFileAttributesExW GlobalLock GlobalFree GlobalAlloc CreateProcessW GetExitCodeProcess WaitForSingleObject DeleteFileW GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW ReadFile GetModuleFileNameW GetStdHandle WriteFile SetFilePointerEx GetConsoleMode ReadConsoleW GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW SetEndOfFile

user32

SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture GetClientRect MessageBoxA GetKeyState LoadCursorA ScreenToClient GetCapture ClientToScreen IsChild GetForegroundWindow SetCapture SetCursor

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

xinput1_3

ord4 ord2

urlmon

URLDownloadToFileA

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

Name

.text

Size

361KB

Virtual Size

360KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

436KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

313KB

Virtual Size

323KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

XhangerCS2Lite.exe

advapi32

kernel32

user32

imm32

xinput1_3

urlmon

wininet

generic